Patch "drm/amd/display: Prevent potential buffer overflow in map_hw_resources" has been added to the 6.7-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drm/amd/display: Prevent potential buffer overflow in map_hw_resources

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-amd-display-prevent-potential-buffer-overflow-in.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e8ade91757eaf66bd2dcbc6e07ec3ed9c6942129
Author: Srinivasan Shanmugam <srinivasan.shanmugam@xxxxxxx>
Date:   Tue Feb 20 09:14:25 2024 +0530

    drm/amd/display: Prevent potential buffer overflow in map_hw_resources
    
    [ Upstream commit 0f8ca019544a252d1afb468ce840c6dcbac73af4 ]
    
    Adds a check in the map_hw_resources function to prevent a potential
    buffer overflow. The function was accessing arrays using an index that
    could potentially be greater than the size of the arrays, leading to a
    buffer overflow.
    
    Adds a check to ensure that the index is within the bounds of the
    arrays. If the index is out of bounds, an error message is printed and
    break it will continue execution with just ignoring extra data early to
    prevent the buffer overflow.
    
    Reported by smatch:
    drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7
    drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7
    
    Fixes: 7966f319c66d ("drm/amd/display: Introduce DML2")
    Cc: Rodrigo Siqueira <Rodrigo.Siqueira@xxxxxxx>
    Cc: Roman Li <roman.li@xxxxxxx>
    Cc: Qingqing Zhuo <Qingqing.Zhuo@xxxxxxx>
    Cc: Aurabindo Pillai <aurabindo.pillai@xxxxxxx>
    Cc: Tom Chung <chiahsuan.chung@xxxxxxx>
    Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@xxxxxxx>
    Suggested-by: Roman Li <roman.li@xxxxxxx>
    Reviewed-by: Roman Li <roman.li@xxxxxxx>
    Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@xxxxxxx>
    Signed-off-by: Alex Deucher <alexander.deucher@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
index 8f231418870f2..c62b61ac45d27 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
@@ -76,6 +76,11 @@ static void map_hw_resources(struct dml2_context *dml2,
 			in_out_display_cfg->hw.DLGRefClkFreqMHz = 50;
 		}
 		for (j = 0; j < mode_support_info->DPPPerSurface[i]; j++) {
+			if (i >= __DML2_WRAPPER_MAX_STREAMS_PLANES__) {
+				dml_print("DML::%s: Index out of bounds: i=%d, __DML2_WRAPPER_MAX_STREAMS_PLANES__=%d\n",
+					  __func__, i, __DML2_WRAPPER_MAX_STREAMS_PLANES__);
+				break;
+			}
 			dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id[num_pipes] = dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id[i];
 			dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id_valid[num_pipes] = true;
 			dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_plane_id[num_pipes] = dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id[i];